3 ms·
Isn't SELinux supposed to provide exactly this functionality? The tricky part are the profiles afaik. But this could be solved with some concentrated community
by still_grokking 6y ago
Isn't SELinux supposed to provide exactly this functionality?
The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess.
I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.
- 0xC0ncord 6y agoSELinux can and does do exactly this, depending on the configuration. What you'll most often see is that applications covered will have rules that allow it to access a subset of the user's home content (xdg cache, data, etc.) that allow that application to function, and SELinux will use UBAC rules to ensure that user A's instance of that application cannot access the data of user B's. Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user. I can't speak much about AppArmor since I'm not too familiar with it.
- yrro 6y agoSELinux can do this--think of it as a second layer of security that is checked after the normal DAC checks (e.g., process uid vs file permissions) succeed.